Ransomware Intelligence / Groups / direwolf

Ransomware group

direwolf

Dire Wolf is a recently emerged double-extortion ransomware group that first appeared around May 2025. It is a crypto-ransomware and data broker targeting industries like manufacturing and technology across multiple countries, including the U.S., Thailand, Taiwan, Singapore, Türkiye, among others. Written in Go and delivered as a UPX-packed binary, it utilizes robust encryption (Curve25519 and ChaCha20) to lock files with a .direwolf extension, while deleting backups, disabling logging, and terminating key services to block recovery. Victims receive highly customized ransom notes containing live-chat credentials and victim-specific portals, indicating a highly professional and targeted approach.

• 3claims, 7 days
• 5claims, 30 days
• 68claims, 90 days
• 2026-06-12first seen
• 2026-11-03last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.